94a5076bce7386929eb5a59f2e2c9a8ed6954a81a127b238d06f6bfbe62660f4

Analysis

max time kernel
8s
max time network
154s
platform
android-9_x86
resource
android-x86-arm-20240910-en
resource tags

arch:armarch:x86image:android-x86-arm-20240910-enlocale:en-usos:android-9-x86system
submitted
18-10-2024 22:04

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

94a5076bce7386929eb5a59f2e2c9a8ed6954a81a127b238d06f6bfbe62660f4.apk
Size

4.2MB
MD5

04b3bd3141066913ad86adff56d78bff
SHA1

57ab9db092806e770b42d3a32b04538763ba858f
SHA256

94a5076bce7386929eb5a59f2e2c9a8ed6954a81a127b238d06f6bfbe62660f4
SHA512

f117e98d85b8c706479979140bd85a38863a3c13458019a33b5aed3cc2a09d1891b3165a1eb097a5d3d8cf76e0e47032692867092ec46514523f70d371c98606
SSDEEP

98304:JZSn/oTRPREuAZ4gCECoW5ovw8MpdbYdq+UjKgkbrMf:unS5SGEZWqNIk9U2dbrA

Score

8^/10

banker discovery evasion persistence

Malware Config

Signatures

Checks if the Android device is rooted. 1 TTPs 2 IoCs

evasion

System Information Discovery

T1426

ioc	Process
/system/xbin/su	ru.crebkvcx.yfvyodqrm
/system/bin/su	ru.crebkvcx.yfvyodqrm

Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 TTPs
banker discovery

Security Software Discovery
T1418.001

Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs

persistence

Broadcast Receivers

T1624.001

description	ioc	Process
Framework service call	android.app.IActivityManager.registerReceiver	ru.crebkvcx.yfvyodqrm

ru.crebkvcx.yfvyodqrm
1⤵
- Checks if the Android device is rooted.
- Registers a broadcast receiver at runtime (usually for listening for system events)
PID:4213
- su
  2⤵
  PID:4279
- su
  2⤵
  PID:4517

Network

MITRE ATT&CK Mobile v15

Initial Access

Execution

Persistence

Event Triggered Execution

T1624

Broadcast Receivers

T1624.001

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Software Discovery

T1418

Security Software Discovery

T1418.001

System Information Discovery

T1426

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

/data/data/ru.crebkvcx.yfvyodqrm/app_error_log/Log/Exception.9.1.7.txt

Filesize
627B

MD5
3de0989414de3efd359fbcab3b40d2de

SHA1
416928f11749ae953c00e74ba150a9bf41c5cd5b

SHA256
94563d14c1b4c872ad86d11457801bba041d4c47b083f8a950d8b4b302a4365c

SHA512
f4ccf79da4537ea259cd0739ba21895f43ca7a82c91ae1095b5930456eeab69e703ec286ebcc8c8134aebb9bbe0c830ad40ba87568bfa5f4ac2f27ad67c2f0b0

Download Submit
/data/data/ru.crebkvcx.yfvyodqrm/databases/PackagesDB

Filesize
272KB

MD5
e8d001005cfa305fe0ef7a8bb2f4b4ba

SHA1
c03adfab75d18724c63d55b7320cd3e14e7ce6d9

SHA256
be2695aca410bd85a617435bc73c2182d4ee355df2eee9cf0a121672fa41709a

SHA512
d2ad974baf2ddd44d0a2afa08a253e6379a9769f2bc6660ff736fbfe389c20b70f1bff8d6d8c42e64731e47dbc255878383d59a7e7bda4bba967054fb7757fd8

Download Submit
/data/data/ru.crebkvcx.yfvyodqrm/databases/PackagesDB-journal

Filesize
512B

MD5
c9273116023be9b038c938a3a1eb6a4a

SHA1
bae79217b38ef3c1d7f5ade8f9b8b8883e145dd0

SHA256
b8aab811ce40ceca414c2b3d8ebbbafe7bfc3572825bd7f8e83e8993958650b8

SHA512
16072be05333cbb0c4e9a76b3fe69679cd9fdd38da7686bd77071da0bd2eef2397da81ff40b9bf58abb31eba3aa3754de541fa88b2cbed36fcb3aab8a7734975

Download Submit
/data/data/ru.crebkvcx.yfvyodqrm/databases/PackagesDB-shm

Filesize
32KB

MD5
bb7df04e1b0a2570657527a7e108ae23

SHA1
5188431849b4613152fd7bdba6a3ff0a4fd6424b

SHA256
c35020473aed1b4642cd726cad727b63fff2824ad68cedd7ffb73c7cbd890479

SHA512
768007e06b0cd9e62d50f458b9435c6dda0a6d272f0b15550f97c478394b743331c3a9c9236e09ab5b9cb3b423b2320a5d66eb3c7068db9ea37891ca40e47012

Download Submit
/data/data/ru.crebkvcx.yfvyodqrm/databases/PackagesDB-wal

Filesize
418KB

MD5
e1033e8ff88447ff55673d4c5b33bfff

SHA1
19ad5dd893326138d6a04c9bf58cbc1615ca9dcf

SHA256
b0f21034fbba3c92e646d39e9b19185e6a015e09aa64331c515c8d11c412acf4

SHA512
0624588e84f320f708fff0a61075c507edf61776fb3d932d45485e75ba726375feefb003184e00f87b5dd2dca3b7b6db556922534dbf402cbf9404235ab50823

Download Submit
/storage/emulated/0/Android/data/ru.crebkvcx.yfvyodqrm/files/LuckyPatcher/AdsBlockList.txt

Filesize
1KB

MD5
634ab5e3e49b830079f88825c88d7f80

SHA1
cabe4068d07d52c60f5b9f840fd887051748a3aa

SHA256
2824000ad496be920c29d0a78589c72935288b40ce44b44c5fae672fbfe87fe4

SHA512
ffc893fcad8d81f6ca272cf03737ab466eafd135599e6f6f20285d7f4c3454bedde4de5929dbb1be5010192747f5f11d86166509f24bfbf778f949762e47ef72

Download Submit
/storage/emulated/0/Android/data/ru.crebkvcx.yfvyodqrm/files/LuckyPatcher/AdsBlockList_user_edit.txt

Filesize
29B

MD5
302f7b6d9a4ffeccdda9ef94184c8326

SHA1
d4038ca0629f57b7e5c4056e74a395e5598aa16a

SHA256
5b36134b695f0a9a32f570b08cc3ef74e0687a0d2aa228853bc0346f77bffebe

SHA512
299fda4936acf6479e22f9166d545976d5d99ba6fe7a5b7298cb336cf730eb7790524e4569fe64bc03c598c7e4117f163ddffc2e2889439f709c4d80ff665039

Download Submit
/storage/emulated/0/Android/data/ru.crebkvcx.yfvyodqrm/files/LuckyPatcher/Log/error_log.txt

Filesize
560KB

MD5
ac846e30b0ac87abd09e29ad3a0208b9

SHA1
3fe313ba7586de7feddd347b0adaee4a88a93a4c

SHA256
77626fc2f25ec0a3bb93ef7db62c0051c03fb371d831ebc60556562d7bbca6cd

SHA512
93078cb3d47d1ef56b421974969d042baf28d16586f3976b50975372b014afe9a0ce9ec20aa11230a5e316e641bc021539e84c17f88e304477dbf53bd3db1b1b

Download Submit